Issue detecting packer.

[danyhm]

Hello,
I have a binary which dedot detects being packed by Babel .Net

C:\de4dotEx3.2.4>de4dot bin.exe -v

de4dotEx v3.2.4.0

  1: Unknown
  0: Agile.NET
120: Babel .NET
  0: CodeFort
  0: CodeVeil
  0: CodeWall
Deobfuscating control flow: System.Void <Module>::.cctor() (06000001)
  0: Confuser
Deobfuscating control flow: System.Byte[] <Module>::‏︈︈︎‱″︃​‮‴​‫︁–‴︄︄︇ ‪︂‒︎′‏︂︊—‏︈︈︎‱″︃​‮‴​‫︁–‴︄︄︇ ‪︂‒︎′‏︂︊—(System.Byte[]) (0600000D)
  0: ConfuserEx
  0: Crypto Obfuscator
Deobfuscating control flow: System.Void <Module>::.cctor() (06000001)
  0: DeepSea
  0: Dotfuscator
  0: .NET Reactor 3.x
Deobfuscating control flow: System.Void –︌‒‍ ‬‍︊‐″︁‌​‌︍″︅︊︀‐‫ ‪‫–︌‒‍ ‬‍︊‐″︁‌​‌︍″︅︊︀‐‫ ‪‫::‌‪︁ –︉‍‮‍‮‰︂‬′‮‴︊‴︎‴︂–‴‴‍‍‑‌‪︁ –︉‍‮‍‮‰︂‬′‮‴︊‴︎‴︂–‴‴‍‍‑() (06001DD5)
  0: .NET Reactor 4.x
  0: Eazfuscator.NET
  0: Goliath.NET
  0: ILProtector
  0: MaxtoCode
  0: MPRESS
  0: Obfuscar
  0: Phoenix Protector
  0: RATMalware
  0: Rummage
  0: Skater .NET
  0: SmartAssembly
  0: Spices.Net
  0: VirtualGuard
  0: Xenocode
  0: DoubleZero Obfuscator
Detected Babel .NET (C:\de4dotEx3.2.4\bin.exe)
Cleaning C:\bin.exe
WARNING: Could not find embedded assemblies resource
ERROR:
ERROR:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Stack trace:
ERROR:    at de4dot.code.deobfuscators.Babel_NET.MethodsDecrypter.CheckEncryptedMethod(MethodDef method, EncryptInfo& info)
ERROR:    at de4dot.code.deobfuscators.Babel_NET.MethodsDecrypter.GetEncryptedMethods()
ERROR:    at de4dot.code.deobfuscators.Babel_NET.MethodsDecrypter.Decrypt()
ERROR:    at de4dot.code.deobfuscators.Babel_NET.Deobfuscator.DeobfuscateBegin()
ERROR:    at de4dot.code.ObfuscatedFile.Deobfuscate()
ERROR:    at de4dot.cui.FilesDeobfuscator.DeobfuscateAllFiles(IEnumerable`1 allFiles)
ERROR:    at de4dot.cui.FilesDeobfuscator.DeobfuscateAll()
ERROR:    at de4dot.cui.FilesDeobfuscator.DoIt()
ERROR:    at de4dot.cui.Program.Main(String[] args)
ERROR:
ERROR:
ERROR: Caught an exception:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Message:
ERROR:   Could not find name of encrypted method
ERROR: Type:
ERROR:   System.ApplicationException
ERROR: ------------------------------------------------------------------------------
ERROR:
ERROR: Try the latest version!

However I suspect it being packed by confuserEx (a custom version)

C:\de4dotEx3.2.4>de4dot bin.exe -p crx -v

de4dotEx v3.2.4.0

Deobfuscating control flow: System.Byte[] <Module>::‏︈︈︎‱″︃​‮‴​‫︁–‴︄︄︇ ‪︂‒︎′‏︂︊—‏︈︈︎‱″︃​‮‴​‫︁–‴︄︄︇ ‪︂‒︎′‏︂︊—(System.Byte[]) (0600000D)
Detected ConfuserEx  (C:\de4dotEx3.2.4\bin.exe)
Cleaning C:\de4dotEx3.2.4\bin.exe
Deobfuscating methods
Deobfuscating System.Void <Module>::.cctor() (06000001)
ERROR:
ERROR:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Stack trace:
ERROR:    at System.IntPtr.ToInt32()
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.x86.X86Method.ParseInstructions(MethodDef method)
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.x86.X86Method..ctor(MethodDef method, ModuleDefMD module)
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.ControlFlowFixer.CalculateKey(SwitchData switchData)
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.ControlFlowFixer.ProcessBlock(List`1 switchCaseBlocks, Block block, Block switchBlock)
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.ControlFlowFixer.DeobfuscateSwitchBlock(List`1 methodBlocks, Block switchBlock)
ERROR:    at de4dot.code.deobfuscators.ConfuserEx.ControlFlowFixer.Deobfuscate(List`1 methodBlocks)
ERROR:    at de4dot.blocks.cflow.BlocksCflowDeobfuscator.Deobfuscate(IEnumerable`1 bds, List`1 allBlocks)
ERROR:    at de4dot.blocks.cflow.BlocksCflowDeobfuscator.Deobfuscate()
ERROR:    at de4dot.code.ObfuscatedFile.Deobfuscate(MethodDef method, BlocksCflowDeobfuscator cflowDeobfuscator, MethodPrinter methodPrinter, Boolean isVerbose, Boolean isVV)
ERROR:    at de4dot.code.ObfuscatedFile.DeobfuscateMethods()
ERROR:    at de4dot.code.ObfuscatedFile.Deobfuscate()
ERROR:    at de4dot.cui.FilesDeobfuscator.DeobfuscateAllFiles(IEnumerable`1 allFiles)
ERROR:    at de4dot.cui.FilesDeobfuscator.DeobfuscateAll()
ERROR:    at de4dot.cui.FilesDeobfuscator.DoIt()
ERROR:    at de4dot.cui.Program.Main(String[] args)
ERROR:
ERROR:
ERROR: Caught an exception:
ERROR:
ERROR: ------------------------------------------------------------------------------
ERROR: Message:
ERROR:   Arithmetic operation resulted in an overflow.
ERROR: Type:
ERROR:   System.OverflowException
ERROR: ------------------------------------------------------------------------------
ERROR:
ERROR: Try the latest version!

do you have any guide on how to make sure which protector is actually used?
also any link to resources for manual unpacking is greatly appreciated.

[meck-gd]

Detection is often a bit fuzzy and false-positive prone, especially if a protector goes out of its way to be detected as something else intentionally.

There's no guide for this stuff, it basically comes down to experience and/or comparing with binaries that you know for sure are protected with a specific protector.

[danyhm]

Detection is often a bit fuzzy and false-positive prone, especially if a protector goes out of its way to be detected as something else intentionally.

There's no guide for this stuff, it basically comes down to experience and/or comparing with binaries that you know for sure are protected with a specific protector.

I have some experience with lighter packers. but this one is giving me a hard time. do you have any guide or references that i can study about this? even manual unpacking is accepted at this point.